I'm using SLES 2015. I want to make membership in the wheel group sufficient for root-privilege access via su.

From Debian distributions, I'm used to uncommenting the command:

auth       sufficient pam_wheel.so trust

in /etc/pam.d/su. But - this doesn't exist in SLES' /etc/pam.d/su file. I entered it manually, after the other auth commands, but - it doesn't work. Also did the same in /etc/pam.d/su-l for good measure, but no help.

What should I do to avoid the password check?


  • I'm not interested in sudo in this respect.
  • I have root access to the machine, obviously.

1 Answer 1


I entered it manually, after the other auth commands, but - it doesn't work.

The order of the items in the stack is important as PAM proceeds through them in sequence.

Citing (from man pam.conf) the relevant explanation for what the sufficient control flag does:

if such a module succeeds and no prior required module has failed the PAM framework returns success to the application or to the superior PAM stack immediately without calling any further modules in the stack. A failure of a sufficient module is ignored and processing of the PAM module stack continues unaffected.

So the order of the auth items in /etc/pam.d/su should probably be:

auth        sufficient  pam_rootok.so
auth        sufficient  pam_wheel.so trust
auth        required    pam_unix.so

Or else you will be asked for a password (via the pam_unix line or possible other entries).

  • Interesting... will try this soon and see if it helps.
    – einpoklum
    Commented Mar 7, 2020 at 17:07
  • I put the two "sufficients" at the top of the file, and also an account sufficient pam_rookok.so which was in there; and that worked. Possibly I didn't need to move everything up.
    – einpoklum
    Commented Jun 10, 2020 at 7:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .